Add WeChat login binding gate and context-aware auth UX.

Stop auto-creating duplicate accounts on OAuth, add bind-or-register gate,
PC scan login, mobile open-in-WeChat guide, and fix localhost session cookies.

Co-authored-by: Cursor <cursoragent@cursor.com>

db.mjs

@@ -215,6 +215,41 @@ export async function migrateSchema(pool) {
       `ALTER TABLE h5_users ADD COLUMN signup_source VARCHAR(32) NULL DEFAULT 'password' AFTER workspace_root`,
     );
   }
+
+  const oauthStateColumns = [
+    ['intent', "VARCHAR(16) NOT NULL DEFAULT 'login' AFTER utm_campaign"],
+    ['bind_user_id', 'CHAR(36) NULL AFTER intent'],
+    ['auth_mode', "VARCHAR(8) NOT NULL DEFAULT 'mp' AFTER bind_user_id"],
+    ['status', "VARCHAR(16) NOT NULL DEFAULT 'pending' AFTER auth_mode"],
+    ['result_kind', 'VARCHAR(32) NULL AFTER status'],
+    ['result_token', 'VARCHAR(512) NULL AFTER result_kind'],
+    ['result_message', 'VARCHAR(255) NULL AFTER result_token'],
+  ];
+  for (const [column, definition] of oauthStateColumns) {
+    if (!(await columnExists(pool, 'h5_wechat_oauth_states', column))) {
+      await pool.query(
+        `ALTER TABLE h5_wechat_oauth_states ADD COLUMN \`${column}\` ${definition}`,
+      );
+    }
+  }
+
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS h5_wechat_pending_binds (
+      token VARCHAR(64) PRIMARY KEY,
+      app_id VARCHAR(32) NOT NULL,
+      openid VARCHAR(64) NOT NULL,
+      unionid VARCHAR(64) NULL,
+      nickname VARCHAR(128) NULL,
+      avatar_url VARCHAR(512) NULL,
+      return_to VARCHAR(512) NULL,
+      utm_source VARCHAR(64) NULL,
+      utm_medium VARCHAR(64) NULL,
+      utm_campaign VARCHAR(64) NULL,
+      expires_at BIGINT NOT NULL,
+      created_at BIGINT NOT NULL,
+      KEY idx_wechat_pending_expires (expires_at)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
 }
 
 export async function initSchema(pool) {